Google Search Results "Hijacked", All Results Are Ads For Fake Security Software?

Status
Not open for further replies.
(Just typed this giant thread then my iPhone dropped signal and the posting timed out, now I have to type this all again, lol, sucks).

I have spent 3 1/2hrs fixing my computer from a pretty brutal attack. I was a ***** and forgot to turn back on the firewall on my main PC after turning it off to set up a wireless router/network a few days ago. Earlier I was browsing the net when all of the sudden popups started coming in about Trojan attacks and such, then an anti-virus program started a scan and was "finding" all these crazy "infections" and describing them as "critical" and blah blah blah, the usual fake stuff meant to scare people into clicking yes. Problem is, it wasn't a "click no or X out and it's gone" case, like it usually is. They started popping up every 10-15 seconds. Then my IE would just open by itself and go to porn sites like porn.com, adult.com, and sone Viagra ad site. Also, when I tried to open Spybot or Ad-Aware, another popup said that programs' exe file was infected and to click to repair it. Of course I didn't fall for that but then I started getting pissed because how was I supposed to fix the problems if the problems were now attacking the programs' that destroy them? I couldn't even go into the registry or anything, everything I'd try to access through "run" was "infected".

I tried to Google search a fix, but all the results came back as ads for fake security programs. Same with all the other major search engines. The only way I could finally search was typing my search directly into the address bar and then AVG (my anti-virus software) notified me that it restored my search results. I couldn't even navigate directly to any sites dealing with anti-virus, spy/ad/malware, or even tech help (like thus site, hence me posting from my iPhone), it would just give me the page you get when you have no Internet connection. But I could navigate to all other sites perfectly fine. FINALLY I managed to install and run Anti-Malware from MalwareBytes. I did the scan, after many tries since the exe for that was also "infected" according to the dumb popups. It seemed to cure the problem. I restarted like it told ne and no more security popups or porn sites opening. However, I tried a Google search and it's still giving me fake results not even relevent to my search, meaning SIMETHING is still lurking in my machine that the Abti-Malware program missed. Also, I still can't navigate to security-related websites, and my RegistryMechanic is apparently gone as the desktop icon is now just the white box with the blue strip on top and clicking on it says something about an invalid shortcut. Does anyone have ANY ideas what this could be, and how to fix it?

I'm running Windiws XP Home Edition with SP3. I've already run Anti-Malware and rebooted which solved all problems except the search results issue (and Registry mechanic being gone). I also just got finished with a SpyBot scan (it found 10 issues and cleared them), and I'm 25mins into an AVG scan.

Sorry for the long post, I just wanted to give as much details as possible to help with a diagnosis and fix suggestions. It's the last issue I need to solve in this night from malware hell to get my PC back to normal. Thanks in advance for any help, it's GREATLY appreciated.
 
I actually think I found the culprit. AVG keeps popping up with the threat detection and I "heal" it then a few hours it comes up again. There are 2 actually, both go to the same exact path. One is called "Trojan BHO.JEW" and the other is "Adware Generic2.TQI" both go to the following path:

C:\System Volume Information\_restore{8F7A5040-4BDA-A5EE-E7EE68E 6A93B}\RP86\A0017930

The Trojan file ends that path in .dll and the Adware file ends that path in .exe.

I googles the BHO.JEW Trojan and the description is exactly what's happening to me, so my educated guess it that gas to be the problem, but I'm no expert, hence me posting here lol.

I'm about to try all those removal steps in that link, but now knowing exactly what it is, does anyone know if there is a specific removal method for that particular Trojan or should those tools in the removal thread do the trick?
 
Status
Not open for further replies.
Back